{"id":"CVE-2026-41568","aliases":["GO-2026-5668","GHSA-vp62-88p7-qqf5"],"title":"Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files","summary":"Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files","severity":"none","vendor":"docker","product":"github.com/docker/docker","ecosystem":"go","affected":["github.com/docker/docker","github.com/moby/moby","github.com/moby/moby/v2 < 2.0.0-beta.14"],"patched":["github.com/moby/moby/v2 2.0.0-beta.14"],"published":"2026-06-25","updated":"2026-08-11","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5668","references":[{"url":"https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5"}],"tags":["osv","go"],"epss":0.00108,"epssPercentile":0.01358,"ingestedAt":"2026-08-12T19:18:08.821Z","slug":"CVE-2026-41568","body":"## Overview\n\nA race condition in the Docker daemon allows an attacker to create arbitrary empty files on the host system during a \"docker cp\" operation by swapping a destination path with a symbolic link.\n\nThe affected code is in the daemon package, specifically the openContainerFS and createIfNotExists methods. This is daemon-owned, Linux-specific code and is not intended for external use as a Go library.\n\n## Affected packages\n\n- `github.com/docker/docker`\n- `github.com/moby/moby`\n- `github.com/moby/moby/v2 < 2.0.0-beta.14`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/moby/moby/v2 2.0.0-beta.14`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}